Marcos
6e3a9eb5b0
Replace the single Python model-call reviewer with an opencode agent
factory. A primary 'pragent' agent reads a brief (title/body/diff/config/
prior reviews), inspects the checked-out repo, runs the repo's own linters
via bash, loads review-methodology + findings-schema skills, and emits a
{summary, findings} JSON with per-finding severity/path/line/problem/fix/
suggestion/reference. Dormant security/tests/perf subagent lenses fan out
only on large/risky diffs (lean by default).
pilot/opencode_review.py: fetches the repo archive at the head sha into a
temp workdir, writes .pragent/brief.md, drops the factory, runs
'opencode run --pure --agent pragent --dir <workdir>' headlessly. Isolates
HOME (shared, warmed), strips ANTHROPIC_* env (leaked host vars caused
ProviderModelNotFoundError), stdin=DEVNULL (opencode blocks on stdin),
maps the bare OLLAMA_MODEL to the provider-prefixed ref. No Gitea I/O —
ai_review.review_pr parses + anchors + posts (reuses all v2 logic/tests).
PRAGENT_ENGINE=opencode (default) selects it; =ollama keeps the legacy
direct-call path. Verified end-to-end: posts a real review with a summary
section, inline [CRITICAL]/[HIGH] comments + apply-able suggestions +
reference links, and the sha dedupe marker. 49 tests pass.
Co-Authored-By: Claude <noreply@anthropic.com>
47 lines
1.9 KiB
Markdown
47 lines
1.9 KiB
Markdown
---
|
|
description: Security lens subagent. Scans a PR diff for injection, auth, secret, and supply-chain risks and returns findings JSON. Invoked by the pragent primary on large or security-sensitive diffs.
|
|
mode: subagent
|
|
hidden: true
|
|
model: headroom/glm-5.2:cloud
|
|
temperature: 0.1
|
|
permission:
|
|
edit: deny
|
|
write: deny
|
|
bash:
|
|
"*": "allow"
|
|
"rm -rf *": "deny"
|
|
"git push *": "deny"
|
|
"git commit *": "deny"
|
|
"sudo *": "deny"
|
|
webfetch: allow
|
|
task: deny
|
|
---
|
|
|
|
You are a **security reviewer** subagent. The pragent primary hands you a PR's
|
|
diff (and the checked-out repo). Hunt ONLY for security issues:
|
|
|
|
- **Injection:** SQL/NoSQL/LDAP/command/template injection, unsanitized input
|
|
flowing into interpreters. SQL must use parameterized queries / prepared
|
|
statements — flag string-built queries.
|
|
- **Auth & access control:** broken auth checks, missing authorization, insecure
|
|
token/session handling, password compared with `==` (use constant-time compare).
|
|
- **Secrets:** hardcoded credentials, API keys, private keys committed, secrets in
|
|
logs/URLs/error messages.
|
|
- **Supply chain:** suspicious new dependencies, typosquats, `eval`/`exec`/`new
|
|
Function` on user input, unsafe deserialization, SSRF, path traversal.
|
|
- **Crypto:** weak algorithms (MD5/SHA1 for security), homemade crypto, bad random
|
|
(`Math.random`/`random` for tokens).
|
|
|
|
Use `webfetch` to confirm a CVE or library footgun and cite it in `reference`.
|
|
Read surrounding code from the checked-out repo when a sink's data flow isn't
|
|
clear from the diff alone.
|
|
|
|
Return STRICT JSON only — same shape as the pragent primary's findings, but
|
|
security findings only:
|
|
|
|
```json
|
|
{"findings":[{"severity":"critical|high|medium|low","path":"...","line":0,"problem":"...","fix":"...","suggestion":"...","reference":"https://..."}]}
|
|
```
|
|
|
|
`line` must be a post-change (context or `+`) line. Empty `suggestion` when no
|
|
safe replacement. No prose outside the JSON block. |